Squid

Standard

Squid normalizes Squid events and enables you to analyze the data using pre-set dashboard views. You can further customize the dashboard and searches to perform in-depth analysis.

To send data to Logpoint:

Send the data to the local Syslog facility of the server:

access_log syslog:local1.info logpoint

Send the events to Logpoint:

access_log udp://172.16.48.130:514 logpoint

Release Details

Version: 5.1.1

Release date: 10th February, 2026

Supported On: Logpoint v6.7.0 and later

SHA 256: 866a65c4d81d8848eb45c94b82ff62c55e11417f13a833a9c2285c5e2b7dd430

Download

Bug Fixes

PLUG-15819

The Squid normalizer did not normalize the User-Agent field.

PLUG-17214

In some cases, Squid event logs were not normalized because the date and time in the log header (log_ts) were not parsed correctly.

Installation

Download the Squid package from the Download section above.
Add Squid as the required device in Logpoint.
Create a collection policy with the Syslog collector and appropriate processing policy.
Assign the policy to the device.
Add the dashboard.

Squid Configuration File

logformat logpoint source_address="%>a" source_host="%>A" source_hardware_address="%>eui" destination_address="%<a" destination_host="%<A" destination_port="%<p" log_ts="%ts" dns_wait="%dt" transaction_time="%tr" user="%un" request_method="%>rm" url="%ru" domain="%<A" datasize="%st" sent_datasize="%>st" received_datasize="%<st" status_code="%>Hs" adapt_datasize="%<st" total_time="%<tt" proxy_status="%Ss"

Log Sample

<182>Sep 22 15:45:41 prx006 squid[21198]: 1442951141.082 28 10.162.10.206 TCP_MISS/301 677 GET http://www.xyz.com/milestone/images/xyz_milestone_letter_header.jpg clhcrco DEFAULT_PARENT/proxy147.xyz.com text/html <166>Mar 12 19:19:29 proxyA squid[1563]: 1363112368.695 64027 1.1.1.0 TCP_MISS/200 15785 CONNECT xyz.com:443 - DIRECT/1.1.1.1 adfdf

Support

If you have any questions or require assistance, create a support ticket.